<?php if (!defined('DASHBOARD_ROOT')) define('DASHBOARD_ROOT', realpath(__DIR__ . '/../..')); require_once DASHBOARD_ROOT . '/api/bootstrap.php'; header('Content-Type: application/json'); if ($_SERVER['REQUEST_METHOD'] !== 'POST') { exit(json_encode(['success' => false, 'error' => 'POST required'])); } CSRF::enforce(); RBAC::enforce('delete.content'); $itemId = (int)($_POST['item_id'] ?? 0); if (!$itemId) { exit(json_encode(['success' => false, 'error' => 'item_id required'])); } Database::execute("DELETE FROM order_items WHERE id = :id", [':id' => $itemId]); exit(json_encode(['success' => true])); 